Hand rolling keys
Cropping information
I travel and don't have access to my paper documents, and I don't have a work phone setup or easy access to a printer or fax. Yes, I could find internet cafes and print and fax them. But I was hoping to find an easier, but still secure solution, that only relied on me, having a network connection, and the guy on the other end was not cryptographically sophisticated. Of course, it would be easier to send a fax or snail other circumstances.
And yes, I know the documents in question are not very interesting. And also yes, I know there might be a man-in-a-tool, and emails from my mortgage guy might have been in principle faked. I have not made an attempt to post a new key-signing algorithm. Just to find out what the best, simple ad hoc solution I can create in a MacGuyver-like spirit.
Question
I want to send documents securely to my mortgage participant to apply for refinancing. Normal people don't know public key encryption from public toilets. What to do?
What I've done?
Make an account for it on the web server I manage. In https directories, although this might be overkill. Send him the URL and instructions on how to generate a password (combine this word and your phone number). He goes to that location and receives a file, which is the second password. He sends me an email stating that he received and copied the password. I log into a web server, check the access logs that no one else but me, and it hasn't been able to access the password file. Then I delete that file, assign its account to the contained password and restart Apache. Then I print the documents to a new URL, protected by a new password that I only know him and I have seen. Unless I was a rootkit and someone changed my logs, but in this case I am screwed in many different ways.
a source to share
Here are the most logical simple options:
- Fax machine.
- Throw it into your office.
- Courier is by recording the delivery.
If software is indeed the option you want to pursue, which doesn't seem really useful in this case, and is much more complicated than necessary, the simplest solution is probably the best:
- Set up an HTTPS server with authentication, email it the address and username from separate email accounts to separate the email accounts, call it and give it a password, and log into your HTTPS server and upload documents over SSL. This keeps the server address, username, and password separate and means that someone will have to travel long enough to get all three pieces of information. So if you're not trying to rip off the CIA or the NSA ... and I think it's pretty safe to say they don't care too much about your mortgage application, you'll be fine.
If I was a mortgage guy and you wanted me to go to all this effort to get the document from you, I will probably tell you that you are from your rocker to fax or fax it, or I will take its the next time I'm in your area.
What you can do is print it out, discard and send every third strip to a ziploc bag with a different courier, each numbered so that it is easy to recover on the other end. If he misses any of the bits, he can send you an email to tell you which bits he is missing, and you can destroy another copy and send the missing bits with a separate courier.
Needless to say, I think you are redoing an unnecessary solution ...
a source to share
I'm a little confused. I guess there was a mortgage guy too.
Why didn't you just call him and give him the password?
Or, since you understand PKI, why not get a certificate, send him a signed S / MIME email, and ask him to send you an encrypted message with the password he chose? Most email clients support S / MIME out of the box and do it fairly easily.
a source to share
I didn't quite understand what the problem is.
Normal people don't know public key encryption from public toilets. What to do?
Do you want to do secure key exchange without public key cryptography or higher mathematical methods like Diffie-Hellman?
Just tell him to passwort / meet him or use encrypted emails (like enigmail)
a source to share